When building a mobile app, and using services3 and/or my custom module, I have a specific requirement:

I want anonymous users to be able to receive their password, in plaintext, in their email, if they give me their email address and if their account exists. If their account doesnt exist, I want to send a different email. I have trouble finding out where to start.

Services has user/request_new_password, and user/password_reset, but both seem to send out a one-time-link through email. Is there an easy way to modify those handlers ?

Otherwise, what would be a good appraoch in my own module ? Just create an entity_metadata_wrapper around the user, set the pass, call save and send the email ?

PS. Please dont start a discussion about that workflow, there is a reason for it. If you have additional advice for security without changing the workflow as described, I'm all ears.

  • I hope you went through this post
    – shrish
    Commented Oct 30, 2014 at 10:24
  • Now I have, thanks. Its fine to generate a new password and mail that out once. It should ofcourse stay encrypted in the db.
    – commonpike
    Commented Oct 30, 2014 at 13:48
  • great! :) you can answer your own question and mark it as answered.
    – shrish
    Commented Oct 30, 2014 at 14:49
  • Oh. Well I'd prefer the system would go through the hoops when changing the password, if it has any hoops. Caches to clean up, sessions to invalidate .. I'd rather hook into something existing, if I can.
    – commonpike
    Commented Oct 30, 2014 at 15:30


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.